AI for credit unions and community banks

The problem you share

You can hire help with AI. You can't hand off the accountability.

Your staff may already use AI tools, and some of your vendors build AI into theirs. The AI inside your vendors' tools belongs in your AI program.

A committee is fine. A committee with no senior owner is where this work stalls.

Here's where we'd start, and none of it needs a big budget.

1. Write the staff use policy.
2. Build an inventory that includes vendor AI.
3. Name one senior owner.
4. Give the board a short AI report each quarter.

Vendor AI kit for credit unions and community banks

Four questions for your vendor rep, and a blank table for the AI inside your vendors' tools. Vendor AI kit for credit unions and community banks.

If you're regulated in Michigan

DIFS Bulletin 2026-03, walked through

On January 14, 2026, Michigan's Department of Insurance and Financial Services issued Bulletin 2026-03 on the use of AI by financial service providers. It's addressed to the providers DIFS regulates. The bulletin is guidance. It says it "does not prescribe specific practices or documentation requirements." Its center is a written AI Systems Program, and if you don't formally use AI, DIFS still expects a staff acceptable-use policy at a minimum.

If DIFS regulates your institution, you can expect to be asked about how you develop, deploy and use AI.

Item 1.10 says a provider "cannot outsource its fundamental risk management responsibility, even when a third party performs a service."

For providers DIFS regulates, item 1.8 says the program should cover AI built by vendors as well as AI you build.

Who this reaches: DIFS covers Michigan state-chartered credit unions and state-chartered banks, alongside a federal regulator: the NCUA for credit unions, and the FDIC or the Federal Reserve for state-chartered banks. If your institution is federally chartered, DIFS doesn't charter or examine you. Your primary regulator is NCUA (federal credit unions) or the OCC (national banks and federal savings associations). The bulletin is still a fair checklist to read.

Bulletin 2026-03 is addressed to the financial service providers DIFS regulates. Its definition covers depository institutions, which Michigan law says includes banks. Ask your counsel how it applies to you.

Source: Michigan DIFS, Bulletin 2026-03-BT/CF/CU, issued Jan 14, 2026. Quotes matched word for word to the PDF fetched Oct 9, 2026. We don't say DIFS requires a template, a deadline, a certification or a named role title.

Does DIFS Bulletin 2026-03 apply to us?

It's addressed to the financial service providers DIFS regulates. DIFS covers Michigan state-chartered credit unions and banks, alongside their federal regulator: the NCUA for credit unions, and the FDIC or the Federal Reserve for banks. If you're federally chartered, DIFS doesn't charter or examine you. Your primary regulator is NCUA (federal credit unions) or the OCC (national banks and federal savings associations). Check your own case with your counsel.

For credit unions

Your board oversees the AI your credit union uses, including what's inside your vendors' tools. If DIFS regulates you, the bulletin puts responsibility with senior management accountable to the board or an appropriate committee of the board. We'll help you write the staff use policy, list the AI you already have (including what's inside your vendors' tools), name the senior owner and set up a short quarterly report to the board.

Federal credit unions are supervised by the NCUA. DIFS covers state-chartered credit unions.

AI that touches members needs the most care: lending, collections, fraud alerts and the contact center. If DIFS regulates you, the bulletin (item 1.9) expects you to tell affected consumers when AI is in use. Start your inventory there.

If you'd rather learn it first, the training covers the same work, plus the DIFS walkthrough. See the training.

For credit union service organizations (CUSOs)

A CUSO is a service provider its credit unions have to oversee, and it's often partly owned by them too. NCUA can't examine CUSOs directly, so the credit unions' own due diligence carries the weight. Expect your owners and credit union clients to ask about the AI in your services.

For community banks

If DIFS regulates your bank, you can expect to be asked about how you develop, deploy and use AI systems.

A guide to AI strategy in a regulated institution

This guide is coming soon. It will cover strategy, what regulators have said, vendor and CUSO AI, member and customer data, board reporting, and a first 90 days. It's for credit union and community bank leaders.

There's no PDF yet. This page is education, not legal advice.

A monthly update on AI in financial institutions

AI in Financial Institutions: October 2026

Who you'll talk to

Jason Swafford was CTO of InfoSec Institute, later acquired by Cengage, where he took the company through SOC 2. He's worked in fintech and education, both regulated, and his focus is protecting personal data while still getting the business what it needs.

Questions

Talk it through

See the training if you want to learn the work first.

Fractional Chief AI Officer

AI by Committee · Shadow AI and Data Leakage